Aave

Tornado Cash

Read

Tornado

/send

<div class="protos">
 <div>
 <div>
 <div>
 Deposits to notorious crypto privacy tool (and hacker-favorite) Tornado Cash may be at risk after malicious code was reportedly introduced to certain user interfaces.
 According to a report by ZeroTwoDAO, published on Sunday:
 “If you have deposited to Tornado Cash using IPFS gateways (like ipfs.io, cf-ipfs.com, eth.link), your note would likely be exposed and the deposited funds are at risk.”
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 It looks like some Tornado Cash UIs (eg https://t.co/JlgMXo60xT) inject malicious code for 100 ETH deposits. Also, there are some suspicious proposals: – https://t.co/dgB7tQHThS – https://t.co/N147u0WTMW Investigation ongoing. pic.twitter.com/80ZqgdMCSJ— sudo rm -rf –no-preserve-root / (@pcaversaccio) February 24, 2024
 </blockquote>
 </div>
 </figure>
 Read more: DeFi has rough weekend with Aave and <a rel="noopener noreferrer nofollow" title="Tornado Cash" href="https://thebittimes.com/tag/tornado-cash.html">Tornado Cash</a> chaos&nbsp;
 The report goes on to explain that user interfaces hosted via the peer-to-peer Interplanetary File System (IPFS) contain ‘<a rel="noopener noreferrer nofollow" title="malicious" href="https://thebittimes.com/tag/malicious.html">malicious</a> javascript code’ that was introduced by pseudonymous community contributor Butterfly Effects in a governance proposal two months ago.&nbsp;
 Consequently, sensitive data about deposits made via IPFS-hosted user interfaces was leaked to a server owned by the exploiter, who could then use the information to steal other depositors’ funds.
 The article gives as an example an Ethereum address that withdrew a total of 3,200 ETH (worth $10 million) on Friday, before redepositing the funds into Tornado Cash the following day.
 This isn’t the first time that <a rel="noopener noreferrer nofollow" title="malicious" href="https://thebittimes.com/tag/malicious.html">malicious</a> code has made its way past <a rel="noopener noreferrer nofollow" title="Tornado Cash" href="https://thebittimes.com/tag/tornado-cash.html">Tornado Cash</a>’s decentralized governance system, however. In May 2023, a governance attack threatened to hand over full control of the protocol before the <a rel="noopener noreferrer nofollow" title="hacker" href="https://thebittimes.com/tag/hacker.html">hacker</a> had a change of heart.
 With Tornado Cash’s three core developers beset by legal issues, monitoring of governance proposals has been left to token holders.
 In August 2022, the US Treasury sanctioned Tornado Cash and related addresses due to its use in money laundering operations and connections to the Lazarus Group of North Korean hackers. Within a month, funds locked in the protocol had dropped by 50%.&nbsp;
 Shortly after the announcement, developer Alexey Pertsev was arrested in the Netherlands. A year later, US-based Roman Storm and Roman Semenov were also charged with money laundering.
 The team has received support from across the crypto community. However, efforts have been hampered by the nature of the sanctions.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 Important campaign update: Yesterday, @gofundme notified the campaign organizers that the fundraiser for @rstormsf's legal defense was cancelled. They cite Term 22 of their terms of service, which can be interpreted to mean they simply didn’t like the fundraiser. pic.twitter.com/xqEFZ9Ncd5— Free Pertsev &amp; Storm (@FreeAlexeyRoman) February 14, 2024
 </blockquote>
 </div>
 </figure>
 Read more: Coin Center loses Tornado Cash lawsuit, intends to appeal&nbsp;
 <h2 class="wp-block-heading" id="h-what-is-a-crypto-mixer">What is a crypto mixer?</h2>
 Tornado Cash is a crypto mixing service allowing users to obscure their funding source or the trail of their transactions, information which is otherwise publicly visible via block explorers.
 While its supporters argue that mixers are legitimate tools to allow for privacy in an otherwise transparent financial record, they are also wildly popular with crypto hackers.
 Since the protocol was slapped with sanctions, cashing out funds that have been ‘tainted’ by association with Tornado Cash has led many to avoid using the service.&nbsp;
 This includes the hackers, who are increasingly opting to fund their attacks through low-scrutiny exchanges, such as FixedFloat, which does not require users to pass know-your-customer (KYC) checks.
 Ironically, FixedFloat itself was hacked for $26 million worth of crypto earlier this month.
 Got a tip? Send us an email or ProtonMail. For more informed news, follow us on&nbsp;X,&nbsp;Instagram,&nbsp;Bluesky, and&nbsp;Google News, or subscribe to our&nbsp;YouTube&nbsp;channel. 
 </div>
 </div>
 </div>
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/tornado-cash-funds-at-risk-after-hacker-injects-malicious-code-tbt80908.html">https://thebittimes.com/tornado-cash-funds-at-risk-after-hacker-injects-malicious-code-tbt80908.html</a>

Tornado Cash funds ‘at risk’ after hacker injects malicious code

Table of Contents

TheBitTimes

Other articles published on Feb 27, 2024

XRP and Uniswap Rally, But Borroe Finance Steals the Spotlight with Groundbreaking DeFi Solutions

Ripple CEO, Brad Garlinghouse, Face Lawsuit Over Alleged Sale of Securities

Ethereum Whales and Their Impact on Market Dynamics

Just-In: Merlin Chain Partners with Tron Network to Boost Bitcoin’s Seamless Integration

Ripple’s XRPL taps Axelar for RWA, cross-chain communication

ENS resolves legal battle with Manifold Finance over eth.link domain through $300k settlement

Join our free newsletter for daily crypto updates!